#26753 [Opn->Fbk]: zend_fetch_list_dtor_id() doesn't check NULL strings
| From: | sniper@php.net | Date: | Thu, 29 Jan 2004 16:44:23 +0000 |
| Subject: | #26753 [Opn->Fbk]: zend_fetch_list_dtor_id() doesn't check NULL strings | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-54136@lists.php.net to get a copy of this message | ||
ID: 26753
Updated by: sniper@php.net
Reported By: Markus dot Lidel at shadowconnect dot com
-Status: Open
+Status: Feedback
Bug Type: Reproducible crash
Operating System: Linux
PHP Version: 4CVS, 5CVS
New Comment:
Why do you use it?
Previous Comments:
------------------------------------------------------------------------
[2003-12-31 08:11:22] Markus dot Lidel at shadowconnect dot com
BTW, found the bug in php4-200312311230 and in php5-200312311230.
------------------------------------------------------------------------
[2003-12-31 08:07:45] Markus dot Lidel at shadowconnect dot com
Description:
------------
If you use the zend_fetch_list_dtor_id function, and you have for
example loaded the "crack" extension (which registers a destructor
using the function register_list_destructors()), php crashes. The
source of the problem is this line:
if (strcmp(type_name, lde->type_name) == 0) {
The register_list_destructors() set lde->type_name to NULL. If you
replace the code with
if (lde->type_name && (strcmp(type_name, lde->type_name) == 0)) {
the function works fine.
Reproduce code:
---------------
int id = zend_fetch_list_dtor_id function("foo");
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=26753&edit=1